110ed2f09d165b3a7ebb28eaf7d1217069e352c82b6dde598ca6a70befb98d1e

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

StardewXnbHack-develop/.editorconfig
Size

2KB
MD5

8bd37554c2d06bd72075bb2fd65b3057
SHA1

8b6c82d337472a4d00d4771664eb020b18efb253
SHA256

32757e5d725eba8aa5733c14465bb6a6ca01a52f3478d2f6cab395c51e70c97d
SHA512

cbb71841ef787899a92d031ed44bedcc0037223b5f72eb2d69e149816ba6b686884cbb3ddfd03cfdc82f3bc3ab1d89a3ec73e824fe752d3316284d347bf9d861

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\editorconfig_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.editorconfig	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.editorconfig\ = "editorconfig_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\editorconfig_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\editorconfig_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\editorconfig_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\editorconfig_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\editorconfig_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2732	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2732	AcroRd32.exe
2732	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2112	1232	cmd.exe	31
PID 1232 wrote to memory of 2112	1232	cmd.exe	31
PID 1232 wrote to memory of 2112	1232	cmd.exe	31
PID 2112 wrote to memory of 2732	2112	rundll32.exe	32
PID 2112 wrote to memory of 2732	2112	rundll32.exe	32
PID 2112 wrote to memory of 2732	2112	rundll32.exe	32
PID 2112 wrote to memory of 2732	2112	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\StardewXnbHack-develop\.editorconfig
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\StardewXnbHack-develop\.editorconfig
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\StardewXnbHack-develop\.editorconfig"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4d586a76a35704729b951573adb72a5a

SHA1
406718f3f17a8d6abffeef9f1bf9d4bd6d3bc68e

SHA256
a8cc93c4a8d9477318d6f322f78287857b132050a14ebb804b1e321742a5e8a8

SHA512
feae8b6151e3faa09b7d523c76f32b38831cc8b530dfec43fce1cc9f83db4d93be1eb558b616dbba915d4e27582402ea4083abd0e3423c1c6db19c560ed3724e

Download Submit